mbox series

[v6,0/4] initramfs-crypt-hook patch

Message ID 20250320-initramfs-crypt-hook-patches-2-v6-0-ef10c11cad94@denx.de (mailing list archive)
Headers show
Series initramfs-crypt-hook patch | expand

Message

Claudius Heine March 20, 2025, 7:43 a.m. UTC 
Hi,

here is v6 of my patchset.

I fixed the issue I found in the last patchset, now the `format-if-empty` process is a bit more power-fail save.

But I suppose that if the luks header could not be written fully, and the `luks` fs type is not detected, it might still cause issues, but I am not sure I can prevent that effectively.

Kind regards,
Claudius

---
Changes in v6:
- luks formatting of format-if-empty will now be redone when if it is a
  luks partition without a TPM2 token, this makes it a bit more
  power-fail save
- Link to v5: https://lore.kernel.org/r/20250313-initramfs-crypt-hook-patches-2-v5-0-fc62d4a2ad29@denx.de

Changes in v5:
- Switch to use TPM2 protected password instead of static initial
  password for encryption
- Link to v4: https://lore.kernel.org/r/20250305-initramfs-crypt-hook-patches-2-v4-0-4170912e5261@denx.de

Changes in v4:
 - improve documentation and commit messages
 - reorder commits, to put re-encryption recovery up front
 - extract static temporary encryption key patch into its own
 - switch from lsblk to blkid

Changes in v3:
 - Rebase on current next
 - Extended `noencrypt` documentation
 - support clevis tokens for re-encryption recovery

Changes in v2:
 - Added more descriptive commit message
 - Added more descriptive documentation about noencrypt option
 - Fixed typos in documentation
 - removed unnecessary setting of /conf/param.conf in initramfs-crypt-hook
 - added re-encryption recovery patch

---
Claudius Heine (4):
      initramfs-crypt-hook: store initial encryption key in TPM2
      initramfs-crypt-hook: add re-encryption recovery
      initramfs-crypt-hook: implement 'noencrypt' option
      initramfs-crypt-hook: add 'format-if-empty' feature

 doc/README.tpm2.encryption.md                      |  25 +++-
 .../initramfs-crypt-hook/files/local-top-complete  | 127 +++++++++++++++++++--
 .../initramfs-crypt-hook_0.7.bb                    |  12 +-
 3 files changed, 146 insertions(+), 18 deletions(-)
---
base-commit: f5661b18b9721eee984ffc3b75169b40508469cb
change-id: 20250305-initramfs-crypt-hook-patches-2-9cc4a027c89a

Best regards,